From: PIENTKA, JOE (WF) (FBI) <JPIENTKA@fbi.sgov.gov> 
Sent: Thursday, September 22, 2016 2:00 PM 


To: HUBIAK, JOSHUA J. (PH) (FBI) <JJHUBIAK @fbi.sgov.gov>; SANDS, ALLISON 
(CG) (FBI) <ASANDS@fbi.sgov.gov>; HEIDE, CURTIS A. (CG) (FBI) 
<CAHEIDE@fbi.sgov.gov>; BATTY, N C. (CYD) (FBI) 
<NCBATTY @fbi.sgov.gov> 

Ce: WIERZBICKI, DANIEL S. (CG) (FBI) <DSWIERZBICKI@fbi.sgov.gov>; 
COTELLESSE, GERALD S. (PH) (FBI) <GSCOTELLESSE@fbi.sgov.gov>: 
STRANAHAN, TIMOTHY (CE) EBD <TMSTRANAHAN@fbi.sgov.gov>; 
NORWAT, BRANDON H. (CD) (FBI) <BHNORWAT@pfbi.sgov.gov>; HELLMAN, 
SCOTT J. (CYD) (FBI) <SJHELLMAN@fbi.sgov.gov>; DRISCOLL, MICHAEL J. 
(PH) (FBI) <MJDRISCOLL@fbi.sgov.gov>; STOFER, JOHN F. (CD) (FBI) 
<JFSTOFER@fbi.sgov.gov>; MARIC, PAUL M. (CD) (FBI) 
<PMMARIC@fbi.sgov.gov> 

Subject: RE: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


Thank you all for your efforts. The CROSSFIRE HURRICANE Team greatly appreciates you running this to 
ground. 


+ SSA John Stofer CD-1D 


+ UC Paul Maric CD-1D 


From: HUBIAK, JOSHUA J. (PH) (FBI) 

Sent: Thursday, September 22, 2016 11:34 AM 

To: SANDS, ALLISON (CG) (FBI); HEIDE, CURTIS A. (CG) (FBI); BATTY, N C. (CYD) (FBI) 

Cc: WIERZBICKI, DANIEL S. (CG) (FBI); COTELLESSE, GERALD S. (PH) (FBI); STRANAHAN, TIMOTHY (CE) (FBI); 
NORWAT, BRANDON H. (CD) (FBI); HELLMAN, SCOTT J. (CYD) (FBI); PIENTKA, JOE (WF) (FBI); DRISCOLL, MICHAEL 
J. (PH) (FBI) 

Subject: RE: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


Allison, 

We will start working on this now and report back what we find out. 
Thanks, 

SA Joshua J Hubiak 

Philadelphia Division 


Cyber Squad - CYB1 


FBI-DWS-01-0000786 


SCO-015658 
SCO-3500U-017139 


No. 1:21-cr-00582-CRC (D.D.C.) DX-518_0001 


Primary Relief Supervisor 
Office: (215) 418- 4036 


Cell: (215) 528-7264 


From: SANDS, ALLISON (CG) (FBI) 

Sent: Thursday, September 22, 2016 11:13 AM 

To: HUBIAK, JOSHUA J. (PH) (FBI); HEIDE, CURTIS A. (CG) (FBI); BATTY, N C. (CYD) (FBI) 

Cc: WIERZBICKI, DANIEL S. (CG) (FBI); COTELLESSE, GERALD S. (PH) (FBI); STRANAHAN, TIMOTHY (CE) (FBI); 
NORWAT, BRANDON H. (CD) (FBI); HELLMAN, SCOTT J. (CYD) (FBI); PIENTKA, JOE (WF) (FBI) 

Subject: RE: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classifications UNCLASSIFLED/ /FOUO 


Good morning Josh, 


The suspect email domain is being hosted on a Listrak server in Litiz, PA. Do you have any POCs at Listrak? 
Would someone in PH be able to go there and see what we can find out regarding trump-email.com? We 
will also get an NSL working through the system but if you can help out with a knock and talk at Listrak it 
would be great. 


Listrak 
529 E Main Street 
Litiz, PA 17543 


Best, 
Special Agent Allison Sands 


Chicago Division/ CY-1 
desk: 312-829-8628 


mobile: 312-965-5872 


From: HUBIAK, JOSHUA J. (PH) (FBI) 

Sent: Thursday, September 22, 2016 4:58 AM 

To: HEIDE, CURTIS A. (CG) (FBI); BATTY, N C. (CYD) (FBI) 

Cc: WIERZBICKI, DANIEL S. (CG) (FBI); COTELLESSE, GERALD S. (PH) (FBI); STRANAHAN, TIMOTHY (CE) (FBI); 
NORWAT, BRANDON H. (CD) (FBI); HELLMAN, SCOTT J. (CYD) (FBI); SANDS, ALLISON (CG) (FBI); PIENTKA, JOE 
(WEF) (FBI) 

Subject: RE: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


FBI-DWS-01-0000787 


SCO-015659 
SCO-3500U-017140 


No. 1:21-cr-00582-CRC (D.D.C.) DX-518_0002 


Let me know if you need anything from PH in regards to the White Paper. 
Thanks, 

SA Joshua J Hubiak 

Philadelphia Division 

Cyber Squad - CYB1 


Primary Relief Supervisor 
Office: (215) 418- 4036 


Cell: (215) 528-7264 


From: HEIDE, CURTIS A. (CG) (FBI) 

Sent: Wednesday, September 21, 2016 5:02 PM 

To: BATTY, N C. (CYD) (FBI); HUBIAK, JOSHUA J. (PH) (FBI) 

Cc: WIERZBICKI, DANIEL S. (CG) (FBI); COTELLESSE, GERALD S. (PH) (FBI); STRANAHAN, TIMOTHY (CE) (FBI); 
NORWAT, BRANDON H. (CD) (FBI); HELLMAN, SCOTT J. (CYD) (FBI); SANDS, ALLISON (CG) (FBI); PIENTKA, JOE 
(WF) (FBI) 

Subject: RE: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


OK excellent. Thanks Nate. 


Per a few conversations with CD today, CG will be opening a 105H case to address the Cl concerns in this 
report, given that it happens to dovetail with another investigation of similar interest. SA Allison Sands will 
be the Case Agent in CG. In the event that we identify any Russian malware or anything else indicating that 
there could be a cyber intrusion related to this, then we'll definitely re-engage Philly/ECOU to keep 
coordinating efforts on this. 


That being said, could we get a copy of the thumb drives to take a look at what’s on them? Either through 
OPWAN or have the originals sent here for Allison’s review as well? Also, any additional insight or thoughts 
on this would be welcomed. 


Hit me up with any questions, and the help is very much appreciated on this end. 
Curtis 


312-829-8432 


From: BATTY, N C. (CYD) (FBI) 

Sent: Wednesday, September 21, 2016 3:46 PM 

To: HUBIAK, JOSHUA J. (PH) (FBI); HEIDE, CURTIS A. (CG) (FBI) 

Cc: WIERZBICKI, DANIEL S. (CG) (FBI); COTELLESSE, GERALD S. (PH) (FBI); STRANAHAN, TIMOTHY (CE) (FBI); 


FBI-DWS-01-0000788 


SCO-015660 
SCO-3500U-01 7141 


No. 1:21-cr-00582-CRC (D.D.C.) DX-518_0003 


NORWAT, BRANDON H. (CD) (FBI); HELLMAN, SCOTT J. (CYD) (FBI) 
Subject: Analysis of Trump White Paper --- UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


Josh, Curtis, by way of update, 


CG (Curtis Heide) just called to inquire about ECOU 1’s involvement in the Trump matter you and | discussed 
yesterday. Curtis has been working (TDY) the election issues and has been called back by CD to work 
matters related to this white paper. CG had a copy of the white paper | forwarded to you from CD channels, 
and was inquiring as to whether ECOU 1 had any logs or other data from the referenced server. 


| communicated to Curtis that we (CyD) haven’t opened a case yet, and based on the information we know, 
ECOU 1 does not have an equity in this issue, as we do not see an intrusion nexus, and we assess the 
information to point primarily to a CD issue (as you mentioned, this could also be a public corruption issue). 
Therefore, ECOU 1 doesn’t intend to open a case unless requested specifically by CD that we do so ina 
supporting role. 


Curtis advised CG would be opening a CD case (105....z or other), in-line with Curtis’ assignment on the 
‘special’. | affirmed that ECOU doesn’t have an equity in the issue for now, and that which field office opens 
the case is a CD matter as far as we are concerned. 


| told Curtis that CyD is ready and willing to assist in any way, and we were glad to open a case if requested. 
| also told him | had sent the white paper to PH, PH had reviewed it, also felt that CyD would open a case 
only as requested in a supporting role, and offered to open a CyD case if requested. 


Curtis, Josh is A/SSA for PH’s cyber squad. PH is ready and willing to assist as needed. Also, could you let me 
know what you’d like done with these (2) thumb drives? We have a chain of custody from their receipt by 
FBI General Counsel James Baker. 


A/AD Sporre asked us to evaluate this for cyber equities, and to provide a assessment from a cyber 
perspective. Below is ECOU 1’s assessment of the white paper and supporting documentation provided to 
us by CyD A/AD Sporre on 9/20/2016. 


V/R 
Nate 


<< File: Analysis of Trump server white paper.docx >> 


Classification: UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


FBI-DWS-01-0000789 


SCO-015661 
SCO-3500U-017142 


No. 1:21-cr-00582-CRC (D.D.C.) DX-518_0004 


Classification: UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED//FOUO 


Classification: UNCLASSIFIED /FOU 


oO 


FBI-DWS-01-0000790 


SCO-015662 
SCO-3500U-017143 


No. 1:21-cr-00582-CRC (D.D.C.) DX-518_0005 


